ASP.NET Core Web API Interview Question #66

What is the difference between 401 Unauthorized and 403 Forbidden in secured APIs?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

401 indicates that valid authentication credentials are missing or were not accepted. 403 indicates that the caller is authenticated but does not have permission to perform the requested operation.

Detailed Explanation

401 indicates that valid authentication credentials are missing or were not accepted. 403 indicates that the caller is authenticated but does not have permission to perform the requested operation.

Clients should generally respond differently: a 401 may require obtaining or refreshing credentials, while a 403 normally means the authenticated identity lacks the required authorization.

Code Example

// Missing/invalid authentication -> typically 401
[Authorize]

// Authenticated but missing required role/policy -> typically 403
[Authorize(Roles = "Admin")]